cbcvebase.
CVE-2020-28185
published 2020-12-24

CVE-2020-28185: User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username…

PriorityP178medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
18.07%
96.8th percentile
User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the system via the username parameter to wizard/initialise.php.

Affected

1 ranges
VendorProductVersion rangeFixed in
terra-mastertos<= 4.2.06—

Detection & IOCsextracted from sources · hover to see the quote

path/wizard/initialise.php↗
commandPOST /wizard/initialise.php HTTP/1.1
commandtab=checkuser&username=admin
  • →Detect exploitation attempts by matching POST requests to /wizard/initialise.php with body parameter 'tab=checkuser' and a 'username' field.
  • →A successful user enumeration response contains all three JSON keys: '"username":', '"email":', and '"status":' in the response body with HTTP 200.
  • →Requests include the header 'X-Requested-With: XMLHttpRequest' and Content-Type 'application/x-www-form-urlencoded; charset=UTF-8' targeting the initialise.php endpoint.
  • →FOFA fingerprinting queries for affected hosts: match on HTTP header containing 'TOS' combined with 'TerraMaster' in page content.
  • ·The vulnerability affects TerraMaster TOS versions up to and including 4.2.06; the endpoint /wizard/initialise.php is only present in these versions. ↗
  • ·The attack requires no authentication (PR:N, UI:N) and is network-reachable, meaning any internet-exposed TerraMaster NAS running a vulnerable TOS version is at risk.
  • ·High EPSS score (0.90659, 99.6th percentile) indicates this vulnerability is very likely being actively exploited in the wild.

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.